feat: add artifact-keeper

- converted the artifact-keeper helm-chart into kustomization manifests
- converted postgres to cnpg
- moved secrets to vault

apps/base/artifact-keeper/cnpg_cluster.yaml

@@ -0,0 +1,94 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: artifact-keeper-postgres
+  namespace: artifact-keeper
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: artifact_registry
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: registry
+      secret:
+        name: postgres-credentials
+      postInitSQL:
+        - CREATE DATABASE dependency_track OWNER registry;
+        - GRANT ALL PRIVILEGES ON DATABASE dependency_track TO registry;
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: "1"
+      memory: 1Gi
+    requests:
+      cpu: 250m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 20Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/artifact-keeper/cnpg_pooler.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: artifact-keeper-postgres-pooler
+  namespace: artifact-keeper
+spec:
+  cluster:
+    name: artifact-keeper-postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: artifact-keeper-pooler
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - artifact-keeper-pooler
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw

apps/base/artifact-keeper/configmap_app-config.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+data:
+  BIND_ADDRESS: "0.0.0.0:8080"
+  LOG_LEVEL: "info,artifact_keeper=debug"
+  STORAGE_BACKEND: "s3"
+  MEILISEARCH_URL: "http://meilisearch:7700"
+  TRIVY_URL: "http://trivy:8090"
+  DEPENDENCY_TRACK_URL: "http://dtrack:8080"
+  DEPENDENCY_TRACK_ENABLED: "true"
+  SCAN_WORKSPACE_PATH: "/scan-workspace"
+  PLUGINS_DIR: "/data/plugins"

apps/base/artifact-keeper/configmap_s3-env.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: s3-env
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+data:
+  S3_ENDPOINT: "https://radosgw.service.consul"
+  S3_BUCKET: "artifact-keeper"
+  S3_REGION: "ap-southeast-2"
+  S3_PATH_STYLE: "true"

apps/base/artifact-keeper/deployment_backend.yaml

@@ -0,0 +1,171 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: backend
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: artifact-keeper
+      app.kubernetes.io/instance: ak
+      app.kubernetes.io/component: backend
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: backend
+    spec:
+      serviceAccountName: backend
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/component
+                      operator: In
+                      values:
+                        - backend
+                topologyKey: kubernetes.io/hostname
+      initContainers:
+        - name: wait-for-postgres
+          image: postgres:16-alpine
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              echo "Waiting for PostgreSQL..."
+              until pg_isready -h artifact-keeper-postgres-pooler -p 5432 -U registry; do
+                sleep 3
+              done
+              echo "PostgreSQL is ready"
+        - name: wait-for-meilisearch
+          image: alpine:3.20
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+              ephemeral-storage: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+              ephemeral-storage: 64Mi
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              echo "Waiting for Meilisearch..."
+              until wget -qO- http://meilisearch:7700/health >/dev/null 2>&1; do
+                sleep 3
+              done
+              echo "Meilisearch is ready"
+      containers:
+        - name: backend
+          image: "ghcr.io/artifact-keeper/artifact-keeper-backend:dev"
+          imagePullPolicy: Always
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              if [ -f /shared/dtrack-api-key ] && [ -s /shared/dtrack-api-key ]; then
+                export DEPENDENCY_TRACK_API_KEY="$(cat /shared/dtrack-api-key)"
+              fi
+              exec /usr/local/bin/artifact-keeper
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+            - name: grpc
+              containerPort: 9090
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: config
+            - configMapRef:
+                name: s3-env
+            - secretRef:
+                name: s3-credentials
+            - secretRef:
+                name: app-secrets
+          resources:
+            limits:
+              cpu: "2"
+              memory: 2Gi
+            requests:
+              cpu: 250m
+              memory: 256Mi
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 5
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: storage
+              mountPath: /data/storage
+              subPath: storage
+            - name: storage
+              mountPath: /data/backups
+              subPath: backups
+            - name: storage
+              mountPath: /data/plugins
+              subPath: plugins
+            - name: scan-workspace
+              mountPath: /scan-workspace
+            - name: shared-config
+              mountPath: /shared
+              readOnly: true
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi
+        - name: storage
+          persistentVolumeClaim:
+            claimName: storage
+        - name: scan-workspace
+          persistentVolumeClaim:
+            claimName: scan-workspace
+        - name: shared-config
+          persistentVolumeClaim:
+            claimName: shared-config

apps/base/artifact-keeper/deployment_dtrack.yaml

@@ -0,0 +1,111 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dtrack
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: dependency-track
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: artifact-keeper
+      app.kubernetes.io/instance: ak
+      app.kubernetes.io/component: dependency-track
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: dependency-track
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      initContainers:
+        - name: wait-for-postgres
+          image: postgres:16-alpine
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              echo "Waiting for PostgreSQL..."
+              until pg_isready -h artifact-keeper-postgres-pooler -p 5432 -U registry; do
+                sleep 3
+              done
+              echo "PostgreSQL is ready"
+      containers:
+        - name: dtrack-api
+          image: "dependencytrack/apiserver:4.11.4"
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: ALPINE_DATABASE_MODE
+              value: "external"
+            - name: ALPINE_DATABASE_URL
+              value: "jdbc:postgresql://artifact-keeper-postgres-pooler:5432/dependency_track"
+            - name: ALPINE_DATABASE_DRIVER
+              value: "org.postgresql.Driver"
+            - name: ALPINE_DATABASE_USERNAME
+              value: "registry"
+            - name: ALPINE_DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-credentials
+                  key: password
+            - name: ALPINE_DATA_DIRECTORY
+              value: "/data"
+            - name: ALPINE_ENFORCE_AUTHENTICATION
+              value: "true"
+            - name: ALPINE_CORS_ENABLED
+              value: "true"
+            - name: ALPINE_CORS_ALLOW_ORIGIN
+              value: "*"
+            - name: JAVA_OPTIONS
+              value: "-Xmx4g"
+          resources:
+            limits:
+              cpu: "2"
+              memory: 6Gi
+            requests:
+              cpu: 250m
+              memory: 4Gi
+          volumeMounts:
+            - name: dtrack-data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi
+        - name: dtrack-data
+          persistentVolumeClaim:
+            claimName: dtrack

apps/base/artifact-keeper/deployment_meilisearch.yaml

@@ -0,0 +1,154 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: meilisearch
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: meilisearch
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: artifact-keeper
+      app.kubernetes.io/instance: ak
+      app.kubernetes.io/component: meilisearch
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: meilisearch
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      initContainers:
+        - name: fix-ownership
+          image: busybox:1.37
+          securityContext:
+            runAsNonRoot: false
+            runAsUser: 0
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - CHOWN
+                - FOWNER
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+              ephemeral-storage: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+              ephemeral-storage: 64Mi
+          command: ["sh", "-c", "chown -R 1000:1000 /meili_data"]
+          volumeMounts:
+            - name: meilisearch-data
+              mountPath: /meili_data
+        - name: version-guard
+          image: busybox:1.37
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          command: ["sh", "-c"]
+          args:
+            - |
+              EXPECTED="v1.12"
+              VERSION_FILE="/meili_data/data.ms/VERSION"
+              if [ ! -f "$VERSION_FILE" ]; then
+                echo "No existing database, fresh start"
+                exit 0
+              fi
+              CURRENT=$(cat "$VERSION_FILE" 2>/dev/null || echo "unknown")
+              echo "Current DB version: $CURRENT, expected image: $EXPECTED"
+              if echo "$CURRENT" | grep -qv "$(echo $EXPECTED | sed 's/^v//')"; then
+                echo "Version mismatch — wiping data.ms for clean re-index"
+                rm -rf /meili_data/data.ms
+                echo "Done. Backend will re-index automatically."
+              else
+                echo "Versions match, keeping existing data"
+              fi
+          volumeMounts:
+            - name: meilisearch-data
+              mountPath: /meili_data
+      containers:
+        - name: meilisearch
+          image: "getmeili/meilisearch:v1.12"
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            readOnlyRootFilesystem: false
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - name: http
+              containerPort: 7700
+              protocol: TCP
+          env:
+            - name: MEILI_MASTER_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: app-secrets
+                  key: MEILISEARCH_API_KEY
+            - name: MEILI_ENV
+              value: "production"
+            - name: MEILI_MAX_INDEXING_THREADS
+              value: "4"
+          resources:
+            limits:
+              cpu: "1"
+              memory: 8Gi
+            requests:
+              cpu: 250m
+              memory: 512Mi
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 7700
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 7700
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+          volumeMounts:
+            - name: meilisearch-data
+              mountPath: /meili_data
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi
+        - name: meilisearch-data
+          persistentVolumeClaim:
+            claimName: meilisearch

apps/base/artifact-keeper/deployment_trivy.yaml

@@ -0,0 +1,87 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trivy
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: trivy
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: artifact-keeper
+      app.kubernetes.io/instance: ak
+      app.kubernetes.io/component: trivy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: trivy
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10000
+        fsGroup: 10000
+      containers:
+        - name: trivy
+          image: "aquasec/trivy:0.62.1"
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          command: ["trivy"]
+          args: ["server", "--listen", "0.0.0.0:8090", "--cache-dir", "/home/trivy/.cache"]
+          ports:
+            - name: http
+              containerPort: 8090
+              protocol: TCP
+          resources:
+            limits:
+              cpu: "1"
+              memory: 2Gi
+            requests:
+              cpu: 250m
+              memory: 256Mi
+          readinessProbe:
+            tcpSocket:
+              port: 8090
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+          livenessProbe:
+            tcpSocket:
+              port: 8090
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          volumeMounts:
+            - name: trivy-cache
+              mountPath: /home/trivy/.cache
+            - name: tmp
+              mountPath: /tmp
+            - name: scan-workspace
+              mountPath: /scan-workspace
+              readOnly: true
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi
+        - name: trivy-cache
+          persistentVolumeClaim:
+            claimName: trivy-cache
+        - name: scan-workspace
+          persistentVolumeClaim:
+            claimName: scan-workspace

apps/base/artifact-keeper/deployment_web.yaml

@@ -0,0 +1,98 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: web
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: artifact-keeper
+      app.kubernetes.io/instance: ak
+      app.kubernetes.io/component: web
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: web
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/component
+                      operator: In
+                      values:
+                        - web
+                topologyKey: kubernetes.io/hostname
+      containers:
+        - name: web
+          image: "ghcr.io/artifact-keeper/artifact-keeper-web:dev"
+          imagePullPolicy: Always
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: NEXT_PUBLIC_API_URL
+              value: ""
+            - name: BACKEND_URL
+              value: "http://backend:8080"
+            - name: NODE_ENV
+              value: "production"
+          resources:
+            limits:
+              cpu: "1"
+              memory: 1Gi
+            requests:
+              cpu: 250m
+              memory: 256Mi
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 5
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: nextjs-cache
+              mountPath: /app/.next/cache
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi
+        - name: nextjs-cache
+          emptyDir:
+            sizeLimit: 1Gi

apps/base/artifact-keeper/ingress.yaml

@@ -0,0 +1,286 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: artifact-keeper
+  namespace: artifact-keeper
+  annotations:
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: 10g
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: artifacts.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: artifacts.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: artifacts.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /health
+            pathType: Exact
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /ready
+            pathType: Exact
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /v2
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /maven
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /npm
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /pypi
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /nuget
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /cargo
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /gems
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /go
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /helm
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /debian
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /rpm
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /alpine
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /composer
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /conan
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /conda
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /swift
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /terraform
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /cocoapods
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /hex
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /pub
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /lfs
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /ivy
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /chef
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /puppet
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /ansible
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /cran
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /huggingface
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /jetbrains
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /vscode
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /proto
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /incus
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /ext
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /dtrack
+            pathType: Prefix
+            backend:
+              service:
+                name: dtrack
+                port:
+                  number: 8080
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: web
+                port:
+                  number: 3000
+  tls:
+    - hosts:
+        - artifacts.k8s.syd1.au.unkin.net
+      secretName: artifacts-tls

apps/base/artifact-keeper/job_dtrack-init.yaml

@@ -0,0 +1,70 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: dtrack-init
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: dependency-track
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: dependency-track
+    spec:
+      restartPolicy: OnFailure
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      containers:
+        - name: dtrack-init
+          image: alpine:3.20
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+              ephemeral-storage: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+              ephemeral-storage: 128Mi
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              apk add --no-cache curl jq >/dev/null 2>&1
+              /bin/sh /scripts/init-dtrack.sh
+          env:
+            - name: DEPENDENCY_TRACK_URL
+              value: "http://dtrack:8080"
+            - name: DEPENDENCY_TRACK_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: app-secrets
+                  key: DEPENDENCY_TRACK_ADMIN_PASSWORD
+          volumeMounts:
+            - name: init-script
+              mountPath: /scripts
+              readOnly: true
+            - name: shared-config
+              mountPath: /shared
+      volumes:
+        - name: init-script
+          configMap:
+            name: dtrack-init
+            defaultMode: 0755
+        - name: shared-config
+          persistentVolumeClaim:
+            claimName: shared-config

apps/base/artifact-keeper/kustomization.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount_backend.yaml
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - configmap_app-config.yaml
+  - configmap_s3-env.yaml
+  - persistentvolumeclaims.yaml
+  - service_backend.yaml
+  - service_dtrack.yaml
+  - service_meilisearch.yaml
+  - service_trivy.yaml
+  - service_web.yaml
+  - deployment_backend.yaml
+  - deployment_dtrack.yaml
+  - deployment_meilisearch.yaml
+  - deployment_trivy.yaml
+  - deployment_web.yaml
+  - job_dtrack-init.yaml
+  - ingress.yaml
+
+configMapGenerator:
+  - name: dtrack-init
+    files:
+      - resources/init-dtrack.sh
+    options:
+      disableNameSuffixHash: true

apps/base/artifact-keeper/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper

apps/base/artifact-keeper/persistentvolumeclaims.yaml

@@ -0,0 +1,78 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: storage
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: cephfs-raid5-delete
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: scan-workspace
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: cephfs-raid5-delete
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: shared-config
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: cephfs-raid5-delete
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: dtrack
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: cephrbd-fast-delete
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: meilisearch
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: cephrbd-fast-delete
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: trivy-cache
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: cephrbd-fast-delete
+  resources:
+    requests:
+      storage: 5Gi

apps/base/artifact-keeper/resources/init-dtrack.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+set -e
+DT_URL="${DEPENDENCY_TRACK_URL:-http://ak-artifact-keeper-dtrack:8080}"
+DT_ADMIN_USER="admin"
+DT_DEFAULT_PASS="admin"
+DT_NEW_PASS="${DEPENDENCY_TRACK_ADMIN_PASSWORD}"
+API_KEY_FILE="/shared/dtrack-api-key"
+
+echo "[dtrack-init] Waiting for Dependency-Track at $DT_URL ..."
+for i in $(seq 1 60); do
+  if curl -sf "$DT_URL/api/version" > /dev/null 2>&1; then break; fi
+  if [ "$i" -eq 60 ]; then echo "[dtrack-init] ERROR: timeout"; exit 1; fi
+  sleep 5
+done
+
+if [ -f "$API_KEY_FILE" ] && [ -s "$API_KEY_FILE" ]; then
+  echo "[dtrack-init] API key already provisioned -- skipping"
+  exit 0
+fi
+
+TOKEN=$(curl -sf -X POST "$DT_URL/api/v1/user/login" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "username=${DT_ADMIN_USER}&password=${DT_NEW_PASS}" 2>/dev/null || true)
+
+if [ -z "$TOKEN" ] || echo "$TOKEN" | grep -qi "FORCE_PASSWORD_CHANGE"; then
+  curl -sf -o /dev/null -X POST "$DT_URL/api/v1/user/forceChangePassword" \
+    -H "Content-Type: application/x-www-form-urlencoded" \
+    -d "username=${DT_ADMIN_USER}&password=${DT_DEFAULT_PASS}&newPassword=${DT_NEW_PASS}&confirmPassword=${DT_NEW_PASS}"
+  TOKEN=$(curl -sf -X POST "$DT_URL/api/v1/user/login" \
+    -H "Content-Type: application/x-www-form-urlencoded" \
+    -d "username=${DT_ADMIN_USER}&password=${DT_NEW_PASS}" 2>/dev/null || true)
+fi
+
+if [ -z "$TOKEN" ]; then echo "[dtrack-init] ERROR: auth failed"; exit 1; fi
+
+API_KEY=$(curl -sf "$DT_URL/api/v1/team" \
+  -H "Authorization: Bearer $TOKEN" | \
+  jq -r '.[] | select(.name == "Automation") | .apiKeys[0].key // empty')
+
+if [ -z "$API_KEY" ]; then echo "[dtrack-init] ERROR: no API key"; exit 1; fi
+
+echo "$API_KEY" > "$API_KEY_FILE"
+echo "[dtrack-init] Done"

apps/base/artifact-keeper/service_backend.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: backend
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP
+    - name: grpc
+      port: 9090
+      targetPort: grpc
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/component: backend

apps/base/artifact-keeper/service_dtrack.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dtrack
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: dependency-track
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/component: dependency-track

apps/base/artifact-keeper/service_meilisearch.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: meilisearch
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: meilisearch
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 7700
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/component: meilisearch

apps/base/artifact-keeper/service_trivy.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: trivy
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: trivy
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8090
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/component: trivy

apps/base/artifact-keeper/service_web.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: web
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: web
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/component: web

apps/base/artifact-keeper/serviceaccount_backend.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backend
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: backend

apps/base/artifact-keeper/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: artifact-keeper
+spec:
+  allowedNamespaces:
+    - artifact-keeper
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/artifact-keeper/vaultstaticsecret.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: artifact-keeper
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/artifact-keeper/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: app-secrets
+  namespace: artifact-keeper
+spec:
+  destination:
+    create: true
+    name: app-secrets
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/artifact-keeper/default/app-secrets
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: s3-credentials
+  namespace: artifact-keeper
+spec:
+  destination:
+    create: true
+    name: s3-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/artifact-keeper/default/s3-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/artifactapi/resources/remotes.yaml

@@ -63,6 +63,7 @@ remotes:
     description: "Gitea download site"
     include_patterns:
       - "act_runner/.*/act_runner-.*-linux-amd64$"
+      - "tea/.*/tea-.*-linux-amd64$"
     cache:
       file_ttl: 0
       index_ttl: 0

apps/base/elastic-system/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: elastic-system
+  name: elastic-system

apps/base/inteldeviceplugins-system/kustomization.yaml

@@ -8,6 +8,7 @@ resources:
 helmCharts:
   - name: intel-device-plugins-operator
     repo: https://intel.github.io/helm-charts/
+    version: "0.35.0"
     releaseName: intel-device-plugins-operator
     namespace: inteldeviceplugins-system
   - name: intel-device-plugins-gpu

apps/base/jfrog/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: jfrog

apps/base/observability/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml

apps/base/observability/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: observability
+  name: observability

apps/base/puppet/cnpg_cluster.yaml

@@ -19,6 +19,24 @@ spec:
       postInitApplicationSQL:
         - CREATE EXTENSION IF NOT EXISTS pg_trgm;
         - CREATE EXTENSION IF NOT EXISTS pgcrypto;
+        - GRANT CONNECT ON DATABASE puppetdb TO puppetdb_read;
+        - GRANT USAGE ON SCHEMA public TO puppetdb_read;
+        - GRANT SELECT ON ALL TABLES IN SCHEMA public TO puppetdb_read;
+        - ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO puppetdb_read;
+  managed:
+    roles:
+      - name: puppetdb_read
+        ensure: present
+        comment: PuppetDB read-only database user
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: postgres-read-credentials
   enablePDB: true
   enableSuperuserAccess: false
   failoverDelay: 0

apps/base/puppet/cnpg_pooler.yaml

@@ -10,8 +10,8 @@ spec:
   instances: 2
   pgbouncer:
     parameters:
-      default_pool_size: "20"
+      default_pool_size: "100"
-      max_client_conn: "100"
+      max_client_conn: "400"
     paused: false
     poolMode: session
   template:
@@ -31,3 +31,36 @@ spec:
               topologyKey: kubernetes.io/hostname
       containers: []
   type: rw
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: puppet-postgres-pooler-ro
+  namespace: puppet
+spec:
+  cluster:
+    name: puppet-postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler-ro
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler-ro
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: ro

apps/base/puppet/configmap_puppetboard-config.yaml

@@ -11,8 +11,11 @@ metadata:
   namespace: puppet
 data:
   PUPPETDB_HOST: "puppetdb"
-  PUPPETDB_PORT: "8080"
+  PUPPETDB_PORT: "8081"
-  LOGLEVEL: "info"
+  PUPPETDB_SSL_VERIFY: "/opt/puppetboard/ssl/ca.pem"
+  PUPPETDB_CERT: "/opt/puppetboard/ssl/puppetboard.pem"
+  PUPPETDB_KEY: "/opt/puppetboard/ssl/puppetboard.key"
+  LOGLEVEL: "debug"
   PUPPETDB_TIMEOUT: "20"
   UNRESPONSIVE_HOURS: "3"
   ENABLE_CATALOG: "False"

apps/base/puppet/configmap_puppetdb-config.yaml

@@ -10,10 +10,14 @@ metadata:
   name: puppetdb-config
   namespace: puppet
 data:
+  USE_OPENVOXSERVER: "true"
   OPENVOXSERVER_HOSTNAME: "puppetca"
   OPENVOXSERVER_PORT: "8140"
   DNS_ALT_NAMES: "openvoxdb,puppetdb,puppetdb.k8s.syd1.au.unkin.net,puppetdb.puppet.svc.cluster.local"
   OPENVOXDB_POSTGRES_HOSTNAME: "puppet-postgres-pooler"
   OPENVOXDB_POSTGRES_DATABASE: "puppetdb"
   OPENVOXDB_POSTGRES_PORT: "5432"
+  OPENVOXDB_READ_POSTGRES_HOSTNAME: "puppet-postgres-pooler-ro"
+  OPENVOXDB_READ_POSTGRES_DATABASE: "puppetdb"
+  OPENVOXDB_READ_POSTGRES_PORT: "5432"
   PUPPETDB_JAVA_ARGS: ""

apps/base/puppet/configmap_puppetdb-read-database.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb-read-database-conf
+  namespace: puppet
+data:
+  read-database.conf: |
+    read-database: {
+      subname: "//"${OPENVOXDB_READ_POSTGRES_HOSTNAME}":"${OPENVOXDB_READ_POSTGRES_PORT}"/"${OPENVOXDB_READ_POSTGRES_DATABASE}
+      username: ${OPENVOXDB_READ_POSTGRES_USER}
+      password: ${OPENVOXDB_READ_POSTGRES_PASSWORD}
+    }

apps/base/puppet/configmap_puppetserver-compiler-config.yaml

@@ -11,8 +11,8 @@ metadata:
   namespace: puppet
 data:
   OPENVOXSERVER_PORT: "8140"
-  DNS_ALT_NAMES: "puppetserver-compiler-0,puppetserver-compiler-1,puppetserver-compiler-2,puppetserver-compiler-3,puppetserver-compiler-4,puppet,puppet.k8s.syd1.au.unkin.net"
+  DNS_ALT_NAMES: "puppetserver-compiler,puppet,puppet.k8s.syd1.au.unkin.net"
-  OPENVOXDB_SERVER_URLS: "http://puppetdb:8080"
+  OPENVOXDB_SERVER_URLS: "https://puppetdb:8081"
   CA_ENABLED: "false"
   CA_HOSTNAME: "puppetca"
   CA_PORT: "8140"

apps/base/puppet/configmap_puppetserver-master-config.yaml

@@ -13,6 +13,6 @@ data:
   OPENVOXSERVER_HOSTNAME: "puppet"
   OPENVOXSERVER_PORT: "8140"
   DNS_ALT_NAMES: "puppet,puppetserver-agents-to-puppet,puppetca,puppet-headless,puppetca.k8s.syd1.au.unkin.net,puppet.k8s.syd1.au.unkin.net"
-  OPENVOXDB_SERVER_URLS: "http://puppetdb:8080"
+  OPENVOXDB_SERVER_URLS: "https://puppetdb:8081"
   CA_ALLOW_SUBJECT_ALT_NAMES: "true"
   PUPPETSERVER_JAVA_ARGS: "-Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false"

apps/base/puppet/cronjob_g10k-code.yaml

@@ -26,38 +26,6 @@ spec:
         spec:
           hostname: g10k-code
           imagePullSecrets: null
-          initContainers:
-            - name: fetch-config
-              image: alpine/git:latest
-              imagePullPolicy: IfNotPresent
-              resources:
-                requests:
-                  cpu: 50m
-                  memory: 64Mi
-                limits:
-                  cpu: 100m
-                  memory: 128Mi
-              args:
-                - |
-                  set -e
-                  echo "Cloning r10k config repository..."
-                  git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/config
-                  cp /tmp/config/r10k.yaml /shared/r10k.yaml
-                  echo "r10k.yaml fetched successfully"
-              command:
-                - /bin/sh
-                - -c
-              securityContext:
-                allowPrivilegeEscalation: false
-                capabilities:
-                  drop:
-                    - all
-                runAsGroup: 999
-                runAsNonRoot: true
-                runAsUser: 999
-              volumeMounts:
-                - mountPath: /shared
-                  name: shared-config
           containers:
             - name: g10k-code
               image: git.unkin.net/unkin/almalinux9-g10k:20260308
@@ -69,11 +37,16 @@ spec:
                 limits:
                   cpu: 200m
                   memory: 256Mi
-              args:
-                - -config
-                - /shared/r10k.yaml
               command:
-                - /usr/bin/g10k
+                - /bin/sh
+                - -c
+              args:
+                - |
+                  set -e
+                  echo "Cloning r10k config repository..."
+                  git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/r10k-config
+                  echo "Running g10k..."
+                  /usr/bin/g10k -config /tmp/r10k-config/r10k.yaml
               envFrom: null
               env: []
               securityContext:
@@ -87,8 +60,6 @@ spec:
               volumeMounts:
                 - mountPath: /etc/puppetlabs/code/
                   name: puppet-code-volume
-                - mountPath: /shared
-                  name: shared-config
           restartPolicy: OnFailure
           securityContext:
             fsGroup: 999
@@ -96,6 +67,3 @@ spec:
             - name: puppet-code-volume
               persistentVolumeClaim:
                 claimName: puppetserver-code-shared
-            - name: shared-config
-              persistentVolumeClaim:
-                claimName: puppetserver-shared-config

apps/base/puppet/cronjob_generate-types.yaml

@@ -0,0 +1,85 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/component: generate-types
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: generate-types
+  namespace: puppet
+spec:
+  schedule: "*/5 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/component: generate-types
+            app.kubernetes.io/instance: puppetserver
+            app.kubernetes.io/name: puppetserver
+            app.kubernetes.io/version: 8.8.0
+        spec:
+          hostname: generate-types
+          imagePullSecrets: null
+          containers:
+            - name: generate-types
+              image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
+              imagePullPolicy: IfNotPresent
+              command:
+                - sh
+                - -c
+              args:
+                - |
+                  /opt/puppetlabs/puppet/bin/gem install deep_merge ipaddr hiera-eyaml toml
+                  find /etc/puppetlabs/code/environments -mindepth 1 -maxdepth 1 -type d | while read -r envdir; do
+                    env="$(basename "$envdir")"
+                    echo "Generating types for $env"
+                    puppet generate types --environment "$env"
+                  done
+              env: []
+              resources:
+                limits:
+                  cpu: 300m
+                  memory: 1Gi
+                requests:
+                  cpu: 200m
+                  memory: 512Mi
+              securityContext:
+                runAsUser: 0
+                runAsNonRoot: false
+                capabilities:
+                  add:
+                    - CAP_CHOWN
+                    - CAP_SETUID
+                    - CAP_SETGID
+                    - CAP_DAC_OVERRIDE
+                    - CAP_AUDIT_WRITE
+                    - CAP_FOWNER
+                    - CHOWN
+                    - SETUID
+                    - SETGID
+                    - DAC_OVERRIDE
+                    - AUDIT_WRITE
+                    - FOWNER
+                  drop:
+                    - all
+              volumeMounts:
+                - mountPath: /etc/puppetlabs/code/
+                  name: puppet-code-volume
+                - mountPath: /etc/puppetlabs/puppet/
+                  name: puppet-puppet-volume
+          restartPolicy: OnFailure
+          securityContext:
+            fsGroup: 999
+          volumes:
+            - name: puppet-code-volume
+              persistentVolumeClaim:
+                claimName: puppetserver-code-shared
+            - name: puppet-puppet-volume
+              persistentVolumeClaim:
+                claimName: puppetserver-compiler-config-shared

apps/base/puppet/deployment_puppetboard.yaml

@@ -29,6 +29,110 @@ spec:
         app.kubernetes.io/version: 8.8.0
     spec:
       enableServiceLinks: false
+      initContainers:
+        - name: wait-puppetserver
+          image: curlimages/curl:8.11.1
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - |
+              echo 'Waiting for puppetserver to become ready...'
+              until printf "." && curl --silent --fail --insecure 'https://puppetca:8140/status/v1/simple' | grep -q '^running$'; do
+                sleep 2;
+              done;
+              echo 'Puppetserver OK ✓'
+          resources:
+            limits:
+              cpu: 20m
+              memory: 32Mi
+            requests:
+              cpu: 20m
+              memory: 32Mi
+        - name: cert-generator
+          image: git.unkin.net/unkin/almalinux9-base:20260308
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+
+              # Set the hostname for the certificate
+              HOSTNAME="puppetboard"
+              CERT_DIR="/opt/puppetboard/ssl"
+
+              # Create certificate directory
+              mkdir -p ${CERT_DIR}
+
+              # Check if certificates already exist
+              if [ -f "${CERT_DIR}/${HOSTNAME}.pem" ] && [ -f "${CERT_DIR}/${HOSTNAME}.key" ] && [ -f "${CERT_DIR}/ca.pem" ]; then
+                echo "Certificates already exist for ${HOSTNAME}, skipping generation"
+                exit 0
+              fi
+
+              # Request certificate from Puppet CA for Puppetboard
+              echo "Requesting certificate for ${HOSTNAME} from puppetca service"
+
+              # Generate private key
+              openssl genrsa -out ${CERT_DIR}/${HOSTNAME}.key 2048
+
+              # Create certificate signing request (CSR)
+              openssl req -new -key ${CERT_DIR}/${HOSTNAME}.key \
+                -out /tmp/${HOSTNAME}.csr \
+                -subj "/CN=${HOSTNAME}"
+
+              # Submit CSR to Puppet CA
+              echo "Submitting certificate request to Puppet CA..."
+              curl -X PUT \
+                --insecure \
+                --data-binary @/tmp/${HOSTNAME}.csr \
+                -H "Content-Type: text/plain" \
+                https://puppetca:8140/puppet-ca/v1/certificate_request/${HOSTNAME}
+
+              # Wait for certificate to be signed (poll the CA)
+              echo "Waiting for certificate to be signed..."
+              for i in {1..30}; do
+                if curl --insecure -f -s https://puppetca:8140/puppet-ca/v1/certificate/${HOSTNAME} > ${CERT_DIR}/${HOSTNAME}.pem; then
+                  echo "Certificate received for ${HOSTNAME}"
+                  break
+                fi
+                echo "Attempt $i: Certificate not ready yet, waiting 10 seconds..."
+                sleep 10
+              done
+
+              # Verify we got the certificate
+              if [ ! -f "${CERT_DIR}/${HOSTNAME}.pem" ] || [ ! -s "${CERT_DIR}/${HOSTNAME}.pem" ]; then
+                echo "Failed to obtain certificate for ${HOSTNAME}"
+                exit 1
+              fi
+
+              # Get CA certificate
+              curl --insecure -f https://puppetca:8140/puppet-ca/v1/certificate/ca > ${CERT_DIR}/ca.pem
+
+              # Set appropriate permissions
+              chmod 644 ${CERT_DIR}/${HOSTNAME}.pem
+              chmod 600 ${CERT_DIR}/${HOSTNAME}.key
+              chmod 644 ${CERT_DIR}/ca.pem
+
+              # Change ownership to puppetboard user (1000:1000)
+              chown -R 1000:1000 ${CERT_DIR}
+
+              echo "Certificate generation completed for ${HOSTNAME}"
+          volumeMounts:
+            - name: puppetboard-certs
+              mountPath: /opt/puppetboard/ssl
+          resources:
+            limits:
+              cpu: 100m
+              memory: 128Mi
+            requests:
+              cpu: 50m
+              memory: 64Mi
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+            allowPrivilegeEscalation: true
       containers:
         - name: puppetboard
           image: ghcr.io/voxpupuli/puppetboard:7.0.1
@@ -56,3 +160,11 @@ spec:
             capabilities:
               drop:
                 - all
+          volumeMounts:
+            - name: puppetboard-certs
+              mountPath: /opt/puppetboard/ssl
+              readOnly: true
+      volumes:
+        - name: puppetboard-certs
+          persistentVolumeClaim:
+            claimName: puppetboard-certs

apps/base/puppet/deployment_puppetdb.yaml

@@ -59,6 +59,16 @@ spec:
                 secretKeyRef:
                   key: username
                   name: postgres-credentials
+            - name: OPENVOXDB_READ_POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: password
+                  name: postgres-read-credentials
+            - name: OPENVOXDB_READ_POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  key: username
+                  name: postgres-read-credentials
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
@@ -78,18 +88,17 @@ spec:
           volumeMounts:
             - mountPath: /opt/puppetlabs/server/data/puppetdb
               name: puppetdb-storage
+            - mountPath: /etc/puppetlabs/puppetdb/conf.d/read-database.conf
+              name: puppetdb-read-database-conf
+              subPath: read-database.conf
       initContainers:
         - name: create-log-dir
           image: docker.io/busybox:1.37
           command:
             - sh
             - -c
+          args:
             - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs
-          volumeMounts:
-            - mountPath: /opt/puppetlabs/server/data/puppetdb
-              name: puppetdb-storage
-          securityContext:
-            runAsUser: 0
           resources:
             limits:
               cpu: 20m
@@ -97,18 +106,25 @@ spec:
             requests:
               cpu: 20m
               memory: 32Mi
-        - command:
+          securityContext:
+            runAsUser: 0
+          volumeMounts:
+            - mountPath: /opt/puppetlabs/server/data/puppetdb
+              name: puppetdb-storage
+
+        - name: pgchecker
+          image: docker.io/busybox:1.37
+          imagePullPolicy: IfNotPresent
+          command:
             - sh
             - -c
+          args:
             - |
               echo 'Waiting for PostgreSQL to become ready...'
               until printf "." && nc -z -w 2 puppet-postgres-pooler 5432; do
                   sleep 2;
               done;
               echo 'PostgreSQL OK ✓'
-          image: docker.io/busybox:1.37
-          imagePullPolicy: IfNotPresent
-          name: pgchecker
           resources:
             limits:
               cpu: 20m
@@ -117,22 +133,24 @@ spec:
               cpu: 20m
               memory: 32Mi
           securityContext:
-            allowPrivilegeEscalation: false
+            runAsUser: 1000
             runAsGroup: 1000
             runAsNonRoot: true
-            runAsUser: 1000
+            allowPrivilegeEscalation: false
-        - command:
+
+        - name: wait-puppetserver
+          image: curlimages/curl:8.11.1
+          imagePullPolicy: IfNotPresent
+          command:
             - sh
             - -c
+          args:
             - |
               echo 'Waiting for puppetserver to become ready...'
               until printf "." && curl --silent --fail --insecure 'https://puppetca:8140/status/v1/simple' | grep -q '^running$'; do
                 sleep 2;
               done;
               echo 'Puppetserver OK ✓'
-          image: curlimages/curl:8.11.1
-          imagePullPolicy: IfNotPresent
-          name: wait-puppetserver
           resources:
             limits:
               cpu: 20m
@@ -141,11 +159,14 @@ spec:
               cpu: 20m
               memory: 32Mi
           securityContext:
-            allowPrivilegeEscalation: false
+            runAsUser: 1000
             runAsGroup: 1000
             runAsNonRoot: true
-            runAsUser: 1000
+            allowPrivilegeEscalation: false
       volumes:
         - name: puppetdb-storage
           persistentVolumeClaim:
             claimName: puppetserver-puppetdb-claim
+        - name: puppetdb-read-database-conf
+          configMap:
+            name: puppetdb-read-database-conf

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -1,5 +1,5 @@
 apiVersion: apps/v1
-kind: StatefulSet
+kind: Deployment
 metadata:
   annotations:
     reloader.stakater.com/auto: "true"
@@ -11,12 +11,10 @@ metadata:
   name: puppetserver-compiler
   namespace: puppet
 spec:
-  podManagementPolicy: OrderedReady
   selector:
     matchLabels:
       app.kubernetes.io/component: puppetserver-compilers
       app.kubernetes.io/name: puppetserver
-  serviceName: puppet-headless
   template:
     metadata:
       labels:
@@ -41,26 +39,14 @@ spec:
         ports:
         - containerPort: 8140
           name: puppetserver
-        envFrom: null
+        envFrom:
+        - configMapRef:
+            name: puppetserver-compiler-config
         env:
         - name: OPENVOXSERVER_HOSTNAME
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
-        - name: OPENVOXSERVER_PORT
-          value: "8140"
-        - name: DNS_ALT_NAMES
-          value: puppetserver-compiler-0,puppetserver-compiler-1,puppetserver-compiler-2,puppetserver-compiler-3,puppetserver-compiler-4,puppet-headless,puppet,puppet.k8s.syd1.au.unkin.net
-        - name: OPENVOXDB_SERVER_URLS
-          value: http://puppetdb:8080
-        - name: CA_ENABLED
-          value: "false"
-        - name: CA_HOSTNAME
-          value: puppetca
-        - name: CA_PORT
-          value: "8140"
-        - name: PUPPETSERVER_JAVA_ARGS
-          value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false
         livenessProbe:
           failureThreshold: 3
           periodSeconds: 30
@@ -108,26 +94,60 @@ spec:
         - mountPath: /var/lib/puppet/keys/
           name: eyaml-keys
           readOnly: true
+        - mountPath: /opt/bin/
+          name: puppet-shared-bins
+        - mountPath: /opt/vault-ca-cert.crt
+          name: vault-ca-cert
+          subPath: ca.crt
+        - mountPath: /docker-custom-entrypoint.d/post-startup/additional-ruby-gems.sh
+          name: additional-ruby-gems
+          subPath: additional-ruby-gems.sh
       initContainers:
-      - args:
+      - name: copy-configmaps
-        - mkdir -p /etc/puppetlabs/puppet/eyaml/keys;
+        image: busybox:1.35
-          mkdir -p /etc/puppetlabs/code/environments;
-          mkdir -p /etc/puppetlabs/puppet/manifests;
-          chown -R puppet:puppet /etc/puppetlabs;
-          chown puppet:puppet /etc/puppetlabs/puppet/r10k.yaml;
-          mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/;
-          touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde;
-          chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/;
         command:
         - sh
         - -c
+        args:
+        - |
+          echo "Copying configmap files to shared volume..."
+          mkdir -p /etc/puppetlabs/puppet
+          cp /configmaps/puppet.conf /etc/puppetlabs/puppet/puppet.conf
+          cp /configmaps/puppetdb.conf /etc/puppetlabs/puppet/puppetdb.conf
+          cp /configmaps/autosign.conf /etc/puppetlabs/puppet/autosign.conf
+          echo "Configmap files copied successfully"
+        volumeMounts:
+        - mountPath: /etc/puppetlabs/puppet/
+          name: puppet-puppet-volume
+        - mountPath: /configmaps/puppet.conf
+          name: compiler-puppet-conf
+          subPath: puppet.conf
+        - mountPath: /configmaps/puppetdb.conf
+          name: compiler-puppetdb-conf
+          subPath: puppetdb.conf
+        - mountPath: /configmaps/autosign.conf
+          name: compiler-autosign-conf
+          subPath: autosign.conf
+
+      - name: perms-and-dirs
+        image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
+        imagePullPolicy: IfNotPresent
+        command:
+        - sh
+        - -c
+        args:
+        - |
+          mkdir -p /etc/puppetlabs/puppet/eyaml/keys
+          mkdir -p /etc/puppetlabs/code/environments
+          mkdir -p /etc/puppetlabs/puppet/manifests
+          chown -R puppet:puppet /etc/puppetlabs
+          chown puppet:puppet /etc/puppetlabs/puppet/r10k.yaml
+          mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/
+          touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde
+          chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/
         env:
         - name: PUPPETSERVER_JAVA_ARGS
           value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false
-        envFrom: null
-        image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
-        imagePullPolicy: IfNotPresent
-        name: perms-and-dirs
         resources:
           limits:
             cpu: 300m
@@ -136,6 +156,8 @@ spec:
             cpu: 200m
             memory: 128Mi
         securityContext:
+          runAsUser: 0
+          runAsNonRoot: false
           capabilities:
             add:
             - CAP_CHOWN
@@ -152,33 +174,75 @@ spec:
             - FOWNER
             drop:
             - all
-          runAsNonRoot: false
-          runAsUser: 0
         volumeMounts:
         - mountPath: /etc/puppetlabs/code/
           name: puppet-code-volume
         - mountPath: /etc/puppetlabs/puppet/
           name: puppet-puppet-volume
+
+      - name: setup-shared-bins
+        image: git.unkin.net/unkin/almalinux9-base:20260308
+        command:
+        - sh
+        - -c
+        args:
+        - |
+          echo "Setting up shared binaries..."
+          mkdir -p /opt/bin
+          mkdir -p /opt/bin/.cache/uv
+
+          # Copy cobbler to shared bin volume
+          cp /configmaps/cobbler-enc /opt/bin/cobbler-enc
+          chmod +x /opt/bin/cobbler-enc
+
+          # Install uv to shared bin volume
+          cd /tmp
+          wget -O uv-x86_64-unknown-linux-gnu.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/astral-sh/uv/releases/download/0.9.20/uv-x86_64-unknown-linux-gnu.tar.gz
+          tar xf uv-x86_64-unknown-linux-gnu.tar.gz
+          cp uv-x86_64-unknown-linux-gnu/uv /opt/bin/uv
+          chmod +x /opt/bin/uv
+
+          echo "Shared binaries setup completed"
+        volumeMounts:
+        - mountPath: /opt/bin/
+          name: puppet-shared-bins
+        - mountPath: /configmaps/cobbler-enc
+          name: puppet-cobbler-enc
+          subPath: cobbler-enc
       securityContext:
         fsGroup: 999
       volumes:
       - name: puppet-code-volume
         persistentVolumeClaim:
           claimName: puppetserver-code-shared
+      - name: puppet-puppet-volume
+        persistentVolumeClaim:
+          claimName: puppetserver-compiler-config-shared
       - name: eyaml-keys
         secret:
           secretName: eyaml-keys
           defaultMode: 0600
-  updateStrategy:
+      - name: compiler-puppet-conf
+        configMap:
+          name: compiler-puppet.conf
+      - name: compiler-puppetdb-conf
+        configMap:
+          name: compiler-puppetdb.conf
+      - name: compiler-autosign-conf
+        configMap:
+          name: compiler-autosign.conf
+      - name: puppet-cobbler-enc
+        configMap:
+          name: puppet-cobbler-enc
+      - name: puppet-shared-bins
+        persistentVolumeClaim:
+          claimName: puppet-shared-bins
+      - name: vault-ca-cert
+        secret:
+          secretName: vault-ca-cert
+      - name: additional-ruby-gems
+        configMap:
+          name: additional-ruby-gems
+          defaultMode: 0755
+  strategy:
     type: RollingUpdate
-  volumeClaimTemplates:
-  - metadata:
-      annotations: null
-      name: puppet-puppet-volume
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 1Gi
-      storageClassName: cephrbd-fast-delete

apps/base/puppet/deployment_puppetserver-master.yaml

@@ -93,28 +93,34 @@ spec:
             - mountPath: /var/lib/puppet/keys/
               name: eyaml-keys
               readOnly: true
+            - mountPath: /opt/bin/
+              name: puppet-shared-bins
+            - mountPath: /opt/vault-ca-cert.crt
+              name: vault-ca-cert
+              subPath: ca.crt
       initContainers:
-        - args:
+        - name: perms-and-dirs
-            - mkdir -p /etc/puppetlabs/puppet/eyaml/keys;
+          image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
-              cp /tmp/puppet/configmap/check_for_masters.sh /etc/puppetlabs/puppet/check_for_masters.sh;
+          imagePullPolicy: IfNotPresent
-              chown puppet:puppet /etc/puppetlabs/puppet/check_for_masters.sh;
-              chmod +x /etc/puppetlabs/puppet/check_for_masters.sh;
-              bash /etc/puppetlabs/puppet/check_for_masters.sh;
-              mkdir -p /etc/puppetlabs/code/environments;
-              mkdir -p /etc/puppetlabs/puppet/manifests;
-              chown -R puppet:puppet /etc/puppetlabs;
-              mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/;
-              touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde;
-              chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/;
           command:
             - sh
             - -c
+          args:
+            - |
+              mkdir -p /etc/puppetlabs/puppet/eyaml/keys
+              cp /tmp/puppet/configmap/check_for_masters.sh /etc/puppetlabs/puppet/check_for_masters.sh
+              chown puppet:puppet /etc/puppetlabs/puppet/check_for_masters.sh
+              chmod +x /etc/puppetlabs/puppet/check_for_masters.sh
+              bash /etc/puppetlabs/puppet/check_for_masters.sh
+              mkdir -p /etc/puppetlabs/code/environments
+              mkdir -p /etc/puppetlabs/puppet/manifests
+              chown -R puppet:puppet /etc/puppetlabs
+              mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/
+              touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde
+              chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/
           envFrom:
             - configMapRef:
                 name: puppetserver-init-config
-          image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
-          imagePullPolicy: IfNotPresent
-          name: perms-and-dirs
           resources:
             limits:
               cpu: 300m
@@ -123,6 +129,8 @@ spec:
               cpu: 200m
               memory: 128Mi
           securityContext:
+            runAsUser: 0
+            runAsNonRoot: false
             capabilities:
               add:
                 - CAP_CHOWN
@@ -139,8 +147,6 @@ spec:
                 - FOWNER
               drop:
                 - all
-            runAsNonRoot: false
-            runAsUser: 0
           volumeMounts:
             - mountPath: /etc/puppetlabs/puppet/
               name: puppet-puppet-storage
@@ -163,3 +169,9 @@ spec:
           secret:
             secretName: eyaml-keys
             defaultMode: 0600
+        - name: puppet-shared-bins
+          persistentVolumeClaim:
+            claimName: puppet-shared-bins
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert

apps/base/puppet/horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml

@@ -11,7 +11,7 @@ metadata:
 spec:
   scaleTargetRef:
     apiVersion: apps/v1
-    kind: StatefulSet
+    kind: Deployment
     name: puppetserver-compiler
   minReplicas: 2
   maxReplicas: 5

apps/base/puppet/ingress_puppetdb.yaml

@@ -6,7 +6,9 @@ metadata:
     kubernetes.io/ingress.class: nginx
     external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
   labels:
     app.kubernetes.io/component: puppetdb
     app.kubernetes.io/instance: puppetserver
@@ -26,3 +28,7 @@ spec:
                   number: 8080
             path: /
             pathType: Prefix
+  tls:
+    - hosts:
+        - puppetdb.k8s.syd1.au.unkin.net
+      secretName: puppetdb-tls

apps/base/puppet/kustomization.yaml

@@ -7,11 +7,13 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
   - cronjob_g10k-code.yaml
+  - cronjob_generate-types.yaml
   - persistentvolumeclaims.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - configmap_puppetboard-config.yaml
   - configmap_puppetdb-config.yaml
+  - configmap_puppetdb-read-database.yaml
   - configmap_puppetserver-compiler-config.yaml
   - configmap_puppetserver-init-config.yaml
   - configmap_puppetserver-init-masters-config.yaml
@@ -31,4 +33,31 @@ resources:
   - service_puppetca.yaml
   - service_puppetboard.yaml
   - service_puppetdb.yaml
-  - statefulset_puppetserver-compiler.yaml
+  - deployment_puppetserver-compiler.yaml
+
+configMapGenerator:
+  - name: compiler-autosign.conf
+    files:
+      - resources/compiler/autosign.conf
+    options:
+      disableNameSuffixHash: true
+  - name: compiler-puppet.conf
+    files:
+      - resources/compiler/puppet.conf
+    options:
+      disableNameSuffixHash: true
+  - name: compiler-puppetdb.conf
+    files:
+      - resources/compiler/puppetdb.conf
+    options:
+      disableNameSuffixHash: true
+  - name: puppet-cobbler-enc
+    files:
+      - resources/cobbler-enc
+    options:
+      disableNameSuffixHash: true
+  - name: additional-ruby-gems
+    files:
+      - resources/additional-ruby-gems.sh
+    options:
+      disableNameSuffixHash: true

apps/base/puppet/persistentvolumeclaims.yaml

@@ -75,16 +75,52 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   labels:
-    app.kubernetes.io/component: r10k-shared-config
+    app.kubernetes.io/component: puppetboard
     app.kubernetes.io/instance: puppetserver
     app.kubernetes.io/name: puppetserver
     app.kubernetes.io/version: 8.8.0
-  name: puppetserver-shared-config
+  name: puppetboard-certs
   namespace: puppet
 spec:
   accessModes:
-    - ReadWriteOnce
+    - ReadWriteMany
   resources:
     requests:
       storage: 1Gi
-  storageClassName: cephrbd-fast-delete
+  storageClassName: cephfs-raid6-delete
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetserver-compilers
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetserver-compiler-config-shared
+  namespace: puppet
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: cephfs-raid6-delete
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: puppet-shared-bins
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 0.9.20
+  name: puppet-shared-bins
+  namespace: puppet
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: cephfs-raid6-delete

apps/base/puppet/resources/additional-ruby-gems.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+set -e
+
+echo "Installing additional Ruby gems..."
+/opt/puppetlabs/puppet/bin/gem install deep_merge
+/opt/puppetlabs/puppet/bin/gem install ipaddr
+/opt/puppetlabs/puppet/bin/gem install hiera-eyaml
+/opt/puppetlabs/puppet/bin/gem install toml
+echo "Additional Ruby gems installed successfully"

apps/base/puppet/resources/cobbler-enc

@@ -0,0 +1,50 @@
+#!/usr/bin/env -S /opt/bin/uv run --quiet --cache-dir /opt/bin/.cache/uv --script
+# /// script
+# requires-python = ">=3.11"
+# dependencies = ['pyyaml','requests']
+# ///
+"""
+External Node Classifier (ENC) for Puppet.
+
+If the environment specified in the YAML file is 'testing',
+the environment is not included in the output.
+"""
+
+import sys
+import yaml
+import requests
+
+def fetch_enc_data(cobbler_url: str, hostname: str) -> str:
+    """
+    Fetches and modifies ENC data from a given URL to ensure classes are in list format.
+    """
+    url = f"{cobbler_url}/cblr/svc/op/puppet/hostname/{hostname}"
+    try:
+        response = requests.get(url, verify='/opt/vault-ca-cert.crt')
+        response.raise_for_status()
+    except requests.RequestException as e:
+        sys.exit(f"Request failed: {e}")
+
+    data = yaml.safe_load(response.text)
+    data["parameters"] = data.get("parameters", {})
+
+    # Ensure 'classes' is in the desired list format
+    if "classes" in data:
+        if isinstance(data["classes"], dict):
+            data["parameters"]["enc_role"] = list(data["classes"].keys())
+            data["classes"] = list(data["classes"].keys())
+        else:
+            data["parameters"]["enc_role"] = list(data["classes"])
+            data["classes"] = list(data["classes"])
+
+    if "environment" in data:
+        data["parameters"]["enc_env"] = data["environment"]
+        if data["environment"] == "testing":
+            del data["environment"]
+
+    return yaml.dump(data)
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        sys.exit(f"Usage: {sys.argv[0]} <hostname>")
+    print(fetch_enc_data("https://cobbler.main.unkin.net", sys.argv[1]))

apps/base/puppet/resources/compiler/autosign.conf

@@ -0,0 +1,15 @@
+# Autosign all nodes from these subnets
+198.18.13.0/24
+198.18.14.0/24
+198.18.15.0/24
+198.18.16.0/24
+198.18.17.0/24
+198.18.20.0/24
+198.18.24.0/24
+198.18.25.0/24
+198.18.26.0/24
+198.18.27.0/24
+198.18.28.0/24
+198.18.29.0/24
+# Autosign all nodes from these domains
+*.main.unkin.net

apps/base/puppet/resources/compiler/puppet.conf

@@ -0,0 +1,23 @@
+[main]
+server = puppetserver-compiler
+serverport = 8140
+dns_alt_names = puppetserver-compiler,puppet-headless,puppet,puppet.k8s.syd1.au.unkin.net
+codedir = /etc/puppetlabs/code
+environmentpath = /etc/puppetlabs/code/environments
+
+[server]
+vardir = /opt/puppetlabs/server/data/puppetserver
+logdir = /var/log/puppetlabs/puppetserver
+rundir = /var/run/puppetlabs/puppetserver
+pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
+node_terminus = exec
+external_nodes = /opt/bin/cobbler-enc
+autosign = /etc/puppetlabs/puppet/autosign.conf
+storeconfigs = true
+storeconfigs_backend = puppetdb
+reports = puppetdb
+usecacheonfailure = false
+
+[user]
+default_manifest = /etc/puppetlabs/code/environments/develop/manifests
+default_environment = develop

apps/base/puppet/resources/compiler/puppetdb.conf

@@ -0,0 +1,3 @@
+[main]
+server_urls = https://puppetdb.k8s.syd1.au.unkin.net
+soft_write_failure = true

apps/base/puppet/vaultstaticsecret.yaml

@@ -35,6 +35,23 @@ spec:
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
+metadata:
+  name: postgres-read-credentials
+  namespace: puppet
+spec:
+  destination:
+    create: true
+    name: postgres-read-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/puppet/default/postgres-read-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
 metadata:
   name: eyaml-keys
   namespace: puppet

apps/base/purelb/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - lbnodeagents.yaml
+  - servicegroups.yaml

apps/base/purelb/lbnodeagents.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: purelb.io/v1
+kind: LBNodeAgent
+metadata:
+  labels:
+    app.kubernetes.io/component: lbnodeagent
+    app.kubernetes.io/name: purelb
+  name: common
+  namespace: purelb
+spec:
+  local:
+    extlbint: kube-lb0
+    localint: default
+    sendgarp: false
+---
+apiVersion: purelb.io/v1
+kind: LBNodeAgent
+metadata:
+  labels:
+    app.kubernetes.io/component: lbnodeagent
+    app.kubernetes.io/name: purelb
+  name: dmz
+  namespace: purelb
+spec:
+  local:
+    extlbint: kube-lb0
+    localint: default
+    sendgarp: false

apps/base/purelb/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: purelb
+  name: purelb

apps/base/purelb/servicegroups.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: purelb.io/v1
+kind: ServiceGroup
+metadata:
+  labels:
+    app.kubernetes.io/component: servicegroup
+    app.kubernetes.io/name: purelb
+  name: common
+  namespace: purelb
+spec:
+  local:
+    v4pools:
+      - aggregation: /32
+        pool: 198.18.200.0/24
+        subnet: 198.18.200.0/24
+---
+apiVersion: purelb.io/v1
+kind: ServiceGroup
+metadata:
+  labels:
+    app.kubernetes.io/component: servicegroup
+    app.kubernetes.io/name: purelb
+  name: dmz
+  namespace: purelb
+spec:
+  local:
+    v4pools:
+      - aggregation: /32
+        pool: 198.18.199.0/24
+        subnet: 198.18.199.0/24

apps/base/reposync/configmap_dnf-conf.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync
+    app.kubernetes.io/name: reposync
+  name: dnf-conf
+  namespace: reposync
+data:
+  dnf.conf: |
+    [main]
+    gpgcheck=1
+    installonly_limit=3
+    clean_requirements_on_remove=True
+    best=True
+    skip_if_unavailable=False
+    max_parallel_downloads=6

apps/base/reposync/configmap_openvox-repo.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-openvox7
+    app.kubernetes.io/name: reposync
+  name: openvox7-openvox-repo
+  namespace: reposync
+data:
+  openvox.repo: |
+    [openvox]
+    name=openvox repository
+    baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/el/9/x86_64/
+    gpgkey=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/GPG-KEY-openvox.pub
+    enabled=1
+    gpgcheck=1

apps/base/reposync/cronjob_reposync-almalinux9-appstream.yaml

@@ -0,0 +1,72 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-almalinux9-appstream
+    app.kubernetes.io/name: reposync
+  name: reposync-almalinux9-appstream
+  namespace: reposync
+spec:
+  schedule: "10 2 * * *"
+  timeZone: "Australia/Sydney"
+  concurrencyPolicy: Forbid
+  suspend: false
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 5
+  jobTemplate:
+    spec:
+      completions: 1
+      parallelism: 1
+      backoffLimit: 3
+      ttlSecondsAfterFinished: 3600
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: reposync
+              image: git.unkin.net/unkin/almalinux9-base:latest
+              imagePullPolicy: Always
+              command: ["/bin/bash", "-c"]
+              args:
+                - |
+                  set -euo pipefail
+                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
+
+                  # Install reposync
+                  dnf install -y dnf-plugins-core
+
+                  # Sync repository
+                  dnf reposync \
+                    --repoid=$REPO_TYPE \
+                    --destdir=/data \
+                    --download-metadata \
+                    --newest-only \
+                    --delete
+
+                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
+              env:
+                - name: REPO_TYPE
+                  value: "appstream"
+              resources:
+                requests:
+                  cpu: 500m
+                  memory: 1Gi
+                limits:
+                  cpu: 2000m
+                  memory: 4Gi
+              volumeMounts:
+                - name: repodata
+                  mountPath: /data
+                  readOnly: false
+                - name: dnf-conf
+                  mountPath: /etc/dnf/dnf.conf
+                  subPath: dnf.conf
+                  readOnly: true
+          volumes:
+            - name: repodata
+              persistentVolumeClaim:
+                claimName: reposync-almalinux9-appstream-repodata
+            - name: dnf-conf
+              configMap:
+                name: dnf-conf

apps/base/reposync/cronjob_reposync-almalinux9-baseos.yaml

@@ -0,0 +1,75 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-almalinux9-baseos
+    app.kubernetes.io/name: reposync
+  name: reposync-almalinux9-baseos
+  namespace: reposync
+spec:
+  schedule: "0 2 * * *"
+  timeZone: "Australia/Sydney"
+  concurrencyPolicy: Forbid
+  suspend: false
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 5
+  jobTemplate:
+    spec:
+      completions: 1
+      parallelism: 1
+      backoffLimit: 3
+      ttlSecondsAfterFinished: 3600
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: reposync
+              image: git.unkin.net/unkin/almalinux9-base:latest
+              imagePullPolicy: Always
+              command: ["/bin/bash", "-c"]
+              args:
+                - |
+                  set -euo pipefail
+                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
+
+                  # Install reposync
+                  dnf install -y dnf-plugins-core
+
+                  # Create repo directory
+                  mkdir -p /data/almalinux/$REPO_TYPE
+
+                  # Sync repository
+                  dnf reposync \
+                    --repoid=$REPO_TYPE \
+                    --destdir=/data/almalinux/$REPO_TYPE \
+                    --download-metadata \
+                    --newest-only \
+                    --delete
+
+                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
+              env:
+                - name: REPO_TYPE
+                  value: "baseos"
+              resources:
+                requests:
+                  cpu: 500m
+                  memory: 1Gi
+                limits:
+                  cpu: 2000m
+                  memory: 4Gi
+              volumeMounts:
+                - name: repodata
+                  mountPath: /data
+                  readOnly: false
+                - name: dnf-conf
+                  mountPath: /etc/dnf/dnf.conf
+                  subPath: dnf.conf
+                  readOnly: true
+          volumes:
+            - name: repodata
+              persistentVolumeClaim:
+                claimName: reposync-almalinux9-baseos-repodata
+            - name: dnf-conf
+              configMap:
+                name: dnf-conf

apps/base/reposync/cronjob_reposync-epel9.yaml

@@ -0,0 +1,72 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-epel9
+    app.kubernetes.io/name: reposync
+  name: reposync-epel9
+  namespace: reposync
+spec:
+  schedule: "20 2 * * *"
+  timeZone: "Australia/Sydney"
+  concurrencyPolicy: Forbid
+  suspend: false
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 5
+  jobTemplate:
+    spec:
+      completions: 1
+      parallelism: 1
+      backoffLimit: 3
+      ttlSecondsAfterFinished: 3600
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: reposync
+              image: git.unkin.net/unkin/almalinux9-base:latest
+              imagePullPolicy: Always
+              command: ["/bin/bash", "-c"]
+              args:
+                - |
+                  set -euo pipefail
+                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
+
+                  # Install reposync
+                  dnf install -y dnf-plugins-core
+
+                  # Sync repository
+                  dnf reposync \
+                    --repoid=$REPO_TYPE \
+                    --destdir=/data \
+                    --download-metadata \
+                    --newest-only \
+                    --delete
+
+                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
+              env:
+                - name: REPO_TYPE
+                  value: "epel"
+              resources:
+                requests:
+                  cpu: 500m
+                  memory: 1Gi
+                limits:
+                  cpu: 2000m
+                  memory: 4Gi
+              volumeMounts:
+                - name: repodata
+                  mountPath: /data
+                  readOnly: false
+                - name: dnf-conf
+                  mountPath: /etc/dnf/dnf.conf
+                  subPath: dnf.conf
+                  readOnly: true
+          volumes:
+            - name: repodata
+              persistentVolumeClaim:
+                claimName: reposync-epel9-repodata
+            - name: dnf-conf
+              configMap:
+                name: dnf-conf

apps/base/reposync/cronjob_reposync-openvox7.yaml

@@ -0,0 +1,78 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-openvox7
+    app.kubernetes.io/name: reposync
+  name: reposync-openvox7
+  namespace: reposync
+spec:
+  schedule: "30 2 * * *"
+  timeZone: "Australia/Sydney"
+  concurrencyPolicy: Forbid
+  suspend: false
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 5
+  jobTemplate:
+    spec:
+      completions: 1
+      parallelism: 1
+      backoffLimit: 3
+      ttlSecondsAfterFinished: 3600
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: reposync
+              image: git.unkin.net/unkin/almalinux9-base:latest
+              imagePullPolicy: Always
+              command: ["/bin/bash", "-c"]
+              args:
+                - |
+                  set -euo pipefail
+                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
+
+                  # Install reposync
+                  dnf install -y dnf-plugins-core
+
+                  # Sync repository
+                  dnf reposync \
+                    --repoid=$REPO_TYPE \
+                    --destdir=/data \
+                    --download-metadata \
+                    --delete
+
+                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
+              env:
+                - name: REPO_TYPE
+                  value: "openvox"
+              resources:
+                requests:
+                  cpu: 500m
+                  memory: 1Gi
+                limits:
+                  cpu: 2000m
+                  memory: 4Gi
+              volumeMounts:
+                - name: repodata
+                  mountPath: /data
+                  readOnly: false
+                - name: dnf-conf
+                  mountPath: /etc/dnf/dnf.conf
+                  subPath: dnf.conf
+                  readOnly: true
+                - name: openvox-repo
+                  mountPath: /etc/yum.repos.d/openvox.repo
+                  subPath: openvox.repo
+                  readOnly: true
+          volumes:
+            - name: repodata
+              persistentVolumeClaim:
+                claimName: reposync-openvox7-repodata
+            - name: dnf-conf
+              configMap:
+                name: dnf-conf
+            - name: openvox-repo
+              configMap:
+                name: openvox7-openvox-repo

apps/base/reposync/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - configmap_dnf-conf.yaml
+  - configmap_openvox-repo.yaml
+  - persistentvolumeclaims.yaml
+  - cronjob_reposync-almalinux9-baseos.yaml
+  - cronjob_reposync-almalinux9-appstream.yaml
+  - cronjob_reposync-epel9.yaml
+  - cronjob_reposync-openvox7.yaml

apps/base/reposync/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: reposync
+  name: reposync

apps/base/reposync/persistentvolumeclaims.yaml

@@ -0,0 +1,64 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-almalinux9-baseos
+    app.kubernetes.io/name: reposync
+  name: reposync-almalinux9-baseos-repodata
+  namespace: reposync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: cephrbd-fast-delete
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-almalinux9-appstream
+    app.kubernetes.io/name: reposync
+  name: reposync-almalinux9-appstream-repodata
+  namespace: reposync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi
+  storageClassName: cephrbd-fast-delete
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-epel9
+    app.kubernetes.io/name: reposync
+  name: reposync-epel9-repodata
+  namespace: reposync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 30Gi
+  storageClassName: cephrbd-fast-delete
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-openvox7
+    app.kubernetes.io/name: reposync
+  name: reposync-openvox7-repodata
+  namespace: reposync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: cephrbd-fast-delete

apps/base/vm-system/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml

apps/base/vm-system/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: vm-system
+  name: vm-system

apps/base/vso-system/clusterrole_vault-service-account-admin.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: vault-service-account-admin
+    app.kubernetes.io/part-of: vault-secrets-system
+  name: vso-system-vault-service-account-admin
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]

apps/base/vso-system/clusterrolebindings.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/part-of: vault-secrets-operator
+  name: vso-system-vault-secrets-operator-auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: vault-secrets-operator-controller-manager
+    namespace: vso-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: vso-system-vault-admin-binding
+    app.kubernetes.io/part-of: vault-secrets-system
+  name: vso-system-vault-admin-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vso-system-vault-service-account-admin
+subjects:
+  - kind: ServiceAccount
+    name: vso-system-vault-admin
+    namespace: vso-system

apps/base/vso-system/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount_vault-admin.yaml
+  - clusterrole_vault-service-account-admin.yaml
+  - clusterrolebindings.yaml

apps/base/vso-system/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: vso-system
+  name: vso-system

apps/base/vso-system/serviceaccount_vault-admin.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: vault-admin
+    app.kubernetes.io/part-of: vault-secrets-system
+  name: vso-system-vault-admin
+  namespace: vso-system

apps/overlays/au-syd1/artifact-keeper/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/artifact-keeper

apps/overlays/au-syd1/elastic-system/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: elastic-system
+
+resources:
+  - ../../../base/elastic-system
+
+helmCharts:
+  - name: eck-operator
+    repo: https://helm.elastic.co
+    version: "3.2.0"
+    releaseName: elastic-operator
+    namespace: elastic-system
+    valuesFile: values.yaml

apps/overlays/au-syd1/elastic-system/values.yaml

@@ -0,0 +1,11 @@
+replicaCount: 2
+resources:
+  limits:
+    cpu: 1
+    memory: 1Gi
+  requests:
+    cpu: 10m
+    memory: 150Mi
+podDisruptionBudget:
+  enabled: true
+  minAvailable: 1

apps/overlays/au-syd1/jfrog/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/jfrog
-
-helmCharts:
-  - name: artifactory-jcr
-    repo: https://charts.jfrog.io
-    version: "107.133.10"
-    releaseName: artifactory-jcr
-    namespace: jfrog
-    valuesFile: values.yaml

apps/overlays/au-syd1/jfrog/values.yaml

@@ -1,63 +0,0 @@
----
-artifactory:
-  ## Artifactory
-  ## See full list of supported Artifactory options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
-  artifactory:
-    ## Default tag is from the artifactory sub-chart in the requirements.yaml
-    image:
-      registry: releases-docker.jfrog.io
-      repository: jfrog/artifactory-jcr
-    resources: {}
-    #  requests:
-    #    memory: "1Gi"
-    #    cpu: "500m"
-    #  limits:
-    #    memory: "4Gi"
-    #    cpu: "1"
-    ## The following Java options are passed to the java process running Artifactory.
-    ## You should set them according to the resources set above.
-    ## IMPORTANT: Make sure resources.limits.memory is at least 1G more than Xmx.
-    javaOpts: {}
-    # xms: "1g"
-    # xmx: "3g"
-    # other: ""
-  installer:
-    platform: jcr-helm
-  ## Nginx
-  ## See full list of supported Nginx options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
-  nginx:
-    enabled: true
-    tlsSecretName: ""
-    service:
-      type: LoadBalancer
-  ## Ingress
-  ## See full list of supported Ingress options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
-  ingress:
-    enabled: false
-    tls:
-  ## PostgreSQL
-  ## See list of supported postgresql options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
-  ## Configuration values for the PostgreSQL dependency sub-chart
-  ## ref: https://github.com/bitnami/charts/blob/master/bitnami/postgresql/README.md
-  postgresql:
-    enabled: true
-  ## This key is required for upgrades to protect old PostgreSQL chart's breaking changes.
-  databaseUpgradeReady: "yes"
-  ## If NOT using the PostgreSQL in this chart (artifactory.postgresql.enabled=false),
-  ## specify custom database details here or leave empty and Artifactory will use embedded derby.
-  ## See full list of database options and documentation in artifactory chart: https://github.com/jfrog/charts/tree/master/stable/artifactory
-  # database:
-  jfconnect:
-    enabled: false
-  rtfs:
-    enabled: false
-  onemodel:
-    enabled: false
-  evidence:
-    enabled: false
-  apptrust:
-    enabled: false
-  unifiedpolicy:
-    enabled: false
-  platformfederation:
-    enabled: false

apps/overlays/au-syd1/observability/kustomization.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: observability
+
+resources:
+  - ../../../base/observability
+
+helmCharts:
+  - name: victoria-metrics-cluster
+    repo: https://victoriametrics.github.io/helm-charts/
+    version: "0.33.0"
+    releaseName: victoria-metrics-cluster
+    namespace: observability
+    valuesFile: values-vmcluster.yaml
+  - name: victoria-metrics-agent
+    repo: https://victoriametrics.github.io/helm-charts/
+    version: "0.30.0"
+    releaseName: victoria-metrics-agent
+    namespace: observability
+    valuesFile: values-vmagent.yaml

apps/overlays/au-syd1/observability/values-vmagent.yaml

@@ -0,0 +1,102 @@
+image:
+  repository: victoriametrics/vmagent
+  pullPolicy: IfNotPresent
+global:
+  scrape_interval: 15s
+podDisruptionBudget:
+  enabled: true
+  maxUnavailable: 1
+podAnnotations:
+  prometheus.io/scrape: "true"
+  prometheus.io/port: "8481"
+replicaCount: 3
+extraArgs:
+  envflag.enable: true
+  envflag.prefix: VM_
+  loggerFormat: json
+  httpListenAddr: :8429
+service:
+  enabled: true
+ingress:
+  enabled: true
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: vmagent.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: vmagent.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+  hosts:
+    - name: vmagent.k8s.syd1.au.unkin.net
+      path:
+        - /
+      port: http
+  tls:
+    - hosts:
+        - vmagent.k8s.syd1.au.unkin.net
+      secretName: vmagent-tls
+  ingressClassName: nginx
+remoteWrite:
+  - url: http://victoria-metrics-cluster-vminsert.observability.svc.cluster.local:8480/insert/0/prometheus/
+scrape_configs:
+  - job_name: vmagent
+    static_configs:
+      - targets: ["localhost:8429"]
+  - job_name: "kubernetes-apiservers"
+    kubernetes_sd_configs:
+      - role: endpoints
+    scheme: https
+    tls_config:
+      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      insecure_skip_verify: true
+    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+    relabel_configs:
+      - source_labels:
+          - __meta_kubernetes_namespace
+          - __meta_kubernetes_service_name
+          - __meta_kubernetes_endpoint_port_name
+        action: keep
+        regex: default;kubernetes;https
+  - job_name: "kubernetes-nodes"
+    scheme: https
+    tls_config:
+      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      insecure_skip_verify: true
+    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+    kubernetes_sd_configs:
+      - role: node
+    relabel_configs:
+      - action: labelmap
+        regex: __meta_kubernetes_node_label_(.+)
+  - job_name: "kubernetes-nodes-cadvisor"
+    scheme: https
+    tls_config:
+      ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      insecure_skip_verify: true
+    bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+    kubernetes_sd_configs:
+      - role: node
+    metrics_path: /metrics/cadvisor
+    relabel_configs:
+      - action: labelmap
+        regex: __meta_kubernetes_node_label_(.+)
+      - source_labels: [__metrics_path__]
+        target_label: metrics_path
+    metric_relabel_configs:
+      - action: replace
+        source_labels: [pod]
+        regex: '(.+)'
+        target_label: pod_name
+        replacement: '${1}'
+      - action: replace
+        source_labels: [container]
+        regex: '(.+)'
+        target_label: container_name
+        replacement: '${1}'
+      - action: replace
+        target_label: name
+        replacement: k8s_stub
+      - action: replace
+        source_labels: [id]
+        regex: '^/system\.slice/(.+)\.service$'
+        target_label: systemd_service_name
+        replacement: '${1}'

apps/overlays/au-syd1/observability/values-vmcluster.yaml

@@ -0,0 +1,185 @@
+vmselect:
+  enabled: true
+  image:
+    repository: victoriametrics/vmselect
+    pullPolicy: IfNotPresent
+    variant: cluster
+  extraArgs:
+    envflag.enable: true
+    envflag.prefix: VM_
+    loggerFormat: json
+    httpListenAddr: :8481
+    dedup.minScrapeInterval: 15s
+    replicationFactor: 2
+  resources:
+    limits:
+      cpu: 500m
+      memory: 1024Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+  horizontalPodAutoscaler:
+    enabled: true
+    maxReplicas: 10
+    minReplicas: 2
+    metrics:
+      - type: Resource
+        resource:
+          name: cpu
+          target:
+            type: Utilization
+            averageUtilization: 60
+    behavior:
+      scaleUp:
+        stabilizationWindowSeconds: 0
+        selectPolicy: Max
+        policies:
+          - type: Percent
+            value: 100
+            periodSeconds: 30
+          - type: Pods
+            value: 4
+            periodSeconds: 30
+      scaleDown:
+        stabilizationWindowSeconds: 300
+        selectPolicy: Min
+        policies:
+          - type: Percent
+            value: 10
+            periodSeconds: 60
+          - type: Pods
+            value: 2
+            periodSeconds: 60
+  podAnnotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "8481"
+  podDisruptionBudget:
+    enabled: true
+    maxUnavailable: 1
+  replicaCount: 2
+  ingress:
+    enabled: true
+    annotations:
+      cert-manager.io/cluster-issuer: vault-issuer
+      cert-manager.io/common-name: vmselect.k8s.syd1.au.unkin.net
+      cert-manager.io/private-key-size: "4096"
+      external-dns.alpha.kubernetes.io/hostname: vmselect.k8s.syd1.au.unkin.net
+      external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    hosts:
+      - name: vmselect.k8s.syd1.au.unkin.net
+        path:
+          - /
+        port: http
+    tls:
+      - hosts:
+          - vmselect.k8s.syd1.au.unkin.net
+        secretName: vmselect-tls
+    ingressClassName: nginx
+
+vminsert:
+  enabled: true
+  image:
+    repository: victoriametrics/vminsert
+    variant: cluster
+    pullPolicy: IfNotPresent
+  extraArgs:
+    envflag.enable: true
+    envflag.prefix: VM_
+    loggerFormat: json
+    httpListenAddr: :8480
+    replicationFactor: 2
+  resources:
+    limits:
+      cpu: 500m
+      memory: 1024Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+  horizontalPodAutoscaler:
+    enabled: true
+    maxReplicas: 10
+    minReplicas: 2
+    metrics:
+      - type: Resource
+        resource:
+          name: cpu
+          target:
+            type: Utilization
+            averageUtilization: 60
+    behavior:
+      scaleUp:
+        stabilizationWindowSeconds: 0
+        selectPolicy: Max
+        policies:
+          - type: Percent
+            value: 100
+            periodSeconds: 30
+          - type: Pods
+            value: 4
+            periodSeconds: 30
+      scaleDown:
+        stabilizationWindowSeconds: 300
+        selectPolicy: Min
+        policies:
+          - type: Percent
+            value: 10
+            periodSeconds: 60
+          - type: Pods
+            value: 2
+            periodSeconds: 60
+  podAnnotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "8480"
+  podDisruptionBudget:
+    enabled: true
+    maxUnavailable: 1
+  replicaCount: 2
+  ingress:
+    enabled: true
+    annotations:
+      cert-manager.io/cluster-issuer: vault-issuer
+      cert-manager.io/common-name: vminsert.k8s.syd1.au.unkin.net
+      cert-manager.io/private-key-size: "4096"
+      external-dns.alpha.kubernetes.io/hostname: vminsert.k8s.syd1.au.unkin.net
+      external-dns.alpha.kubernetes.io/target: 198.18.200.0
+      nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+    hosts:
+      - name: vminsert.k8s.syd1.au.unkin.net
+        path:
+          - /
+        port: http
+    tls:
+      - hosts:
+          - vminsert.k8s.syd1.au.unkin.net
+        secretName: vminsert-tls
+    ingressClassName: nginx
+
+vmstorage:
+  enabled: true
+  image:
+    repository: victoriametrics/vmstorage
+    variant: cluster
+    pullPolicy: IfNotPresent
+  retentionPeriod: 180d
+  extraArgs:
+    envflag.enable: true
+    envflag.prefix: VM_
+    loggerFormat: json
+    httpListenAddr: :8482
+    dedup.minScrapeInterval: 15s
+  podAnnotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "8482"
+  podDisruptionBudget:
+    enabled: true
+    maxUnavailable: 1
+  persistentVolume:
+    enabled: true
+    name: vmstorage-volume
+    accessModes:
+      - ReadWriteOnce
+    storageClassName: cephrbd-fast-delete
+    mountPath: /storage
+    size: 200Gi
+  replicaCount: 3
+  podManagementPolicy: OrderedReady

apps/overlays/au-syd1/purelb/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: purelb
+
+resources:
+  - ../../../base/purelb
+
+helmCharts:
+  - name: purelb
+    repo: https://gitlab.com/api/v4/projects/20400619/packages/helm/stable
+    version: "v0.13.0"
+    releaseName: purelb
+    namespace: purelb
+    valuesFile: values.yaml

apps/overlays/au-syd1/purelb/values.yaml

@@ -0,0 +1,56 @@
+image:
+  repository: registry.gitlab.com/purelb/purelb
+  tag: v0.13.0
+  pullPolicy: Always
+
+allocator:
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 65534
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - all
+    readOnlyRootFilesystem: true
+  tolerations: []
+
+lbnodeagent:
+  extlbint: kube-lb0
+  localint: default
+  sendgarp: false
+  tolerations: []
+  containerSecurityContext:
+    capabilities:
+      add:
+        - NET_ADMIN
+        - NET_RAW
+      drop:
+        - ALL
+    readOnlyRootFilesystem: false
+    runAsGroup: 0
+    runAsUser: 0
+
+defaultAnnouncer: PureLB
+
+serviceGroup:
+  create: false
+  name: default
+
+Prometheus:
+  allocator:
+    Metrics:
+      enabled: false
+    serviceMonitor:
+      enabled: false
+    prometheusRules:
+      enabled: false
+  lbnodeagent:
+    Metrics:
+      enabled: false
+    serviceMonitor:
+      enabled: false
+    prometheusRules:
+      enabled: false
+
+memberlistSecretKey: 8sb7ikA5qHwQQqxc

apps/overlays/au-syd1/reposync/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: reposync
+
+resources:
+  - ../../../base/reposync

apps/overlays/au-syd1/vm-system/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: vm-system
+
+resources:
+  - ../../../base/vm-system
+
+helmCharts:
+  - name: victoria-metrics-operator
+    repo: https://victoriametrics.github.io/helm-charts/
+    version: "0.57.1"
+    releaseName: victoria-metrics-operator
+    namespace: vm-system
+    valuesFile: values.yaml

apps/overlays/au-syd1/vm-system/values.yaml

@@ -0,0 +1,9 @@
+logLevel: "info"
+replicaCount: 2
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 50m
+    memory: 128Mi

apps/overlays/au-syd1/vso-system/kustomization.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: vso-system
+
+resources:
+  - ../../../base/vso-system
+
+helmCharts:
+  - name: vault-secrets-operator
+    repo: https://helm.releases.hashicorp.com
+    version: "1.2.0"
+    releaseName: vault-secrets-operator
+    namespace: vso-system
+    valuesFile: values.yaml
+
+patches:
+  - path: patch_vaultauth-remove-namespace.yaml
+    target:
+      group: secrets.hashicorp.com
+      version: v1beta1
+      kind: VaultAuth
+      name: default

apps/overlays/au-syd1/vso-system/patch_vaultauth-remove-namespace.yaml

@@ -0,0 +1,2 @@
+- op: remove
+  path: /spec/namespace

apps/overlays/au-syd1/vso-system/values.yaml

@@ -0,0 +1,28 @@
+defaultVaultConnection:
+  enabled: true
+  address: "https://vault.service.consul:8200"
+  skipTLSVerify: false
+  caCertSecret: "vault-ca-cert"
+
+defaultAuthMethod:
+  enabled: true
+  method: "kubernetes"
+  mount: "k8s/au/syd1"
+  namespace: ""
+  kubernetes:
+    role: "default"
+    serviceAccount: "vault-secrets-operator-controller-manager"
+    tokenAudiences: ["vault"]
+
+controller:
+  replicas: 3
+  resources:
+    limits:
+      cpu: 500m
+      memory: 256Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+
+globalVaultAuth:
+  enabled: true

argocd/applicationsets/kustomization.yaml

@@ -3,5 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - observability.yaml
   - platform.yaml
   - storage.yaml

argocd/applicationsets/observability.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: observability-apps
+  namespace: argocd
+spec:
+  generators:
+  - git:
+      repoURL: https://git.unkin.net/unkin/argocd-apps
+      revision: HEAD
+      directories:
+      - path: apps/overlays/*/observability
+  template:
+    metadata:
+      name: 'observability-{{path[3]}}'
+    spec:
+      project: observability
+      source:
+        repoURL: https://git.unkin.net/unkin/argocd-apps
+        targetRevision: HEAD
+        path: '{{path}}'
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: '{{path[3]}}'
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - ServerSideApply=true

argocd/applicationsets/platform.yaml

@@ -12,16 +12,21 @@ spec:
       directories:
       - path: apps/overlays/*/artifactapi
       - path: apps/overlays/*/cattle-system
-      - path: apps/overlays/*/certificates
       - path: apps/overlays/*/cert-manager
+      - path: apps/overlays/*/certificates
       - path: apps/overlays/*/cnpg-system
+      - path: apps/overlays/*/elastic-system
       - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/inteldeviceplugins-system
+      - path: apps/overlays/*/jfrog
       - path: apps/overlays/*/node-feature-discovery
+      - path: apps/overlays/*/puppet
+      - path: apps/overlays/*/purelb
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
-      - path: apps/overlays/*/jfrog
+      - path: apps/overlays/*/reposync
-      - path: apps/overlays/*/puppet
+      - path: apps/overlays/*/vm-system
+      - path: apps/overlays/*/vso-system
       - path: apps/overlays/*/woodpecker
   template:
     metadata:

argocd/projects/kustomization.yaml

@@ -3,5 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - observability.yaml
   - platform.yaml
   - storage.yaml

argocd/projects/observability.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: observability
+  namespace: argocd
+spec:
+  description: Observability stack (metrics, monitoring)
+  sourceRepos:
+    - https://git.unkin.net/unkin/argocd-apps
+    - https://victoriametrics.github.io/helm-charts/
+  destinations:
+    - namespace: 'observability'
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: ''
+      kind: Namespace
+    - group: 'rbac.authorization.k8s.io'
+      kind: ClusterRole
+    - group: 'rbac.authorization.k8s.io'
+      kind: ClusterRoleBinding
+  namespaceResourceWhitelist:
+    - group: '*'
+      kind: '*'

argocd/projects/platform.yaml

@@ -8,14 +8,18 @@ spec:
   description: Platform infrastructure and core services
   sourceRepos:
     - https://git.unkin.net/unkin/argocd-apps
+    - https://charts.jetstack.io
+    - https://cloudnative-pg.github.io/charts
+    - https://helm.elastic.co
+    - https://helm.releases.hashicorp.com
+    - https://purelb.github.io/purelb/charts
+    - https://intel.github.io/helm-charts/
+    - https://kubernetes-sigs.github.io/external-dns/
+    - https://releases.rancher.com/server-charts/stable
+    - https://victoriametrics.github.io/helm-charts/
+    - oci://gcr.io/k8s-staging-nfd/charts
     - oci://ghcr.io/emberstack/helm-charts
     - oci://ghcr.io/woodpecker-ci/helm/woodpecker
-    - https://releases.rancher.com/server-charts/stable
-    - https://charts.jetstack.io
-    - https://kubernetes-sigs.github.io/external-dns/
-    - https://cloudnative-pg.github.io/charts
-    - oci://gcr.io/k8s-staging-nfd/charts
-    - https://intel.github.io/helm-charts/
   destinations:
     - namespace: '*-system'
       server: https://kubernetes.default.svc
@@ -31,8 +35,12 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'node-feature-discovery'
       server: https://kubernetes.default.svc
+    - namespace: 'purelb'
+      server: https://kubernetes.default.svc
     - namespace: 'puppet'
       server: https://kubernetes.default.svc
+    - namespace: 'reposync'
+      server: https://kubernetes.default.svc
     - namespace: 'woodpecker'
       server: https://kubernetes.default.svc
   clusterResourceWhitelist:
@@ -50,6 +58,16 @@ spec:
       kind: ValidatingWebhookConfiguration
     - group: 'scheduling.k8s.io'
       kind: PriorityClass
+    - group: 'purelb.io'
+      kind: '*'
+    - group: 'nfd.k8s-sigs.io'
+      kind: NodeFeatureRule
+    - group: 'deviceplugin.intel.com'
+      kind: '*'
+    - group: 'cert-manager.io'
+      kind: Certificate
+    - group: 'cert-manager.io'
+      kind: Issuer
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'

ci/validate-apps.sh

@@ -18,6 +18,6 @@ while IFS= read -r -d "" k; do
         -summary \
         -output pretty \
         -verbose \
-        -skip CustomResourceDefinition \
+        -skip CustomResourceDefinition,GpuDevicePlugin,LBNodeAgent,ServiceGroup \
         "${schema_args[@]}"
 done < <(find apps/overlays -name kustomization.yaml -print0)